February 2009 - syslog-ng - lists.balabit.hu

syslog-ng +bash history
by Marcin Niskiewicz 05 Feb '09

05 Feb '09

Hello Everything that is written by users on console (my system is gentoo) is logged in 3 different files (debug , syslog, messages) ... I'd like to route all history logs to one file only... i made a filter and it works fine (it writes history to history.log) but still it writes it to those 3 files (debug , syslog, messages) as well ... so now everything I type is written to 4 files (debug , syslog, messages and history.log) ... is there possibility to configure syslog-ng to log history only to one file (for example history.log) and leave others files clean? best regards nichu My standard configuration (with my modifiication to route history to history.log) looks like this: # Copyright 2005 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.hardened,v 1.5 2007/10/30 17:16:15 solar Exp $ # # Syslog-ng configuration file, compatible with default hardened installations. # options { chain_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); file("/dev/tty12"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail/mail.log"); }; destination avc { file("/var/log/avc.log"); }; destination audit { file("/var/log/audit.log"); }; destination pax { file("/var/log/pax.log"); }; destination grsec { file("/var/log/grsec.log"); }; destination historia { file("/var/log/history.log"); }; destination mailinfo { file("/var/log/mail/mail.info"); }; destination mailwarn { file("/var/log/mail/mail.warn"); }; destination mailerr { file("/var/log/mail/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_avc { match(".*avc: .*"); }; filter f_audit { match("^audit.*") and not match(".*avc: .*"); }; filter f_pax { match("^PAX:.*"); }; filter f_grsec { match("^grsec:.*"); }; filter f_history { match(".*HISTORY*"); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(kernsrc); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_history); destination(history); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); };

2 3

Postgres database questions
by Liam Kirsher 05 Feb '09

05 Feb '09

Hi -- I'm considering using syslog-ng to log to a postgres database, and just wanted to make sure I could do what I want to do before I spend a lot of time discovering that I can't. So, some of these questions probably have obvious answers. The client and loghost systems are running CentOS 5.2, which comes with syslog-ng v. 1.6. I believe I will need to upgrade to syslog-ng 3.0 (OSE) to use the database logging functionality. Correct? I noticed there was a recent message regarding difficulty compiling on CentOS 5.2 -- I hope this is not a problem. It looked like the suggested fix *should* have worked. I just don't want to end up in the syslog-ng Heartbreak Hotel! The only examples of database logging to Postgres I could find were to log the entire message, and/or were for older versions of syslog-ng. What I want to do is break the message up into columns and just log those columns. Reading the documentation, it seems like what I need to do is create a parser which will split the message up as desired. From there, I should be able to log to a database table with the desired fields. Right? Is this the correct approach, and are there any examples of how to do this, other than the cursory descriptions in the documentation? Thanks, Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 1

syslog-ng vs. SEC problems after upgrading to 2.1.3
by Jyri Hovila 05 Feb '09

05 Feb '09

Hi everyone! I've been running syslog-ng and SEC (Simple Event Correlator, http://www.estpak.ee/~risto/sec/) on several Arch Linux (www.archlinux.org) servers for few years now. After upgrading to syslog-ng 2.1.3 things suddenly stopped working on all five servers with identical configuration. Here's what's going on: The syslog-ng part of the deal goes like this (from /etc/syslog- ng.conf): destination d_sec { program("/usr/bin/perl /usr/share/sec/sec.pl - input=\"-\" -conf=/usr/local/etc/sec.conf"); }; log { source(src); destination(d_sec); }; This setup has been working fine all these years; it's been sending all incoming syslog messages to SEC, which has been parsing the messages just fine. After upgrading to syslog-ng 2.1.3, SEC stopped receiving anything from syslog-ng. These messages are being logged to /var/log/everything every 10 minutes: Jan 28 13:36:14 2 syslog-ng[19411]: Log statistics; dropped='program(/ usr/bin/perl /usr/share/sec/sec.pl -input="-" -conf=/usr/local/etc/ sec.conf)=0', processed='center(queued)=255119', processed='center(received)=123603', processed='destination(d_sec)=123603', processed='destination(acpid)=0', processed='destination(console)=0', processed='destination(debug)=0', processed='destination(mail)=5485', processed='destination(user)=309', processed='destination(uucp)=0', processed='destination(messages)=1163', processed='destination(ppp)=0', processed='destination(news)=0', processed='destination(iptables)=92399', processed='destination(everything)=6778', processed='destination(lpr)=0', processed='destination(cron)=0', processed='destination(syslog)=123', processed='destination(authlog)=24426', processed='destination(errors)=5', processed='destination(kernel)=147', processed='destination(daemon)=681', processed='destination(console_all)=0', processed='source(src)=123603', suppressed='program(/usr/bin/perl /usr/ share/sec/sec.pl -input="-" -conf=/usr/local/etc/sec.conf)=0' ps aux tells me that SEC is running fine, but it seems syslog-ng doesn't want to speak to it properly. I have no idea where to go from here. Any tips, anyone? Thanks in advance! Yours, Jyri

2 1

Getting warnings while building syslog-ng-2.1.3 on HP-UX ITA64
by Chanchal Verma 05 Feb '09

05 Feb '09

Hi, I am trying to build syslog-ng-2.1.3 on HP-UX Itenium (64-bit) box. I am doing '--enable-dynamic-linking' and it is giving following warning messages while 'make'. ************************Warning messages during 'make' ******************* .. .. gcc -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -lcl -o loggen loggen.o -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap ld: (Warning) Unsatisfied symbol "yyleng" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytext" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylex" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyout" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "deny_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "allow_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "rfc931_timeout" in file /usr/lib/hpux32/libwrap.so 20 warnings. ******************************************************************************* It is giving me similar error message while running syslog-nd daemon and fail. I have installed flex to get rid of libl.so but no success. # swlist |grep -i flex flex 2.5.4a flex # gcc -v Using built-in specs. Target: ia64-hp-hpux11.31 Configured with: ../gcc/configure Thread model: posix gcc version 4.2.3 Here is configure result: ================================ syslog-ng Open Source Edition 2.1.3 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -I/usr/local/include/glib-2.0 -I/usr/local/lib/hpux32/glib-2.0/include -I/opt/soe/local/syslog-ng-2.1.3/eventlog/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap prefix : /opt/soe/local/syslog-ng-2.1.3 Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no ================================ Any help will be highly appreciated. -- Chanchal

2 1

Re: [syslog-ng] Writing to a named Pipe
by Pedro Rafael Alves Simoes 05 Feb '09

05 Feb '09

The patch worked. Is there any way to create the pipes on the fly? Date: Thu, 22 Jan 2009 19:39:48 +0100 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Writing to a named Pipe To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1232649588.15998.177.camel(a)bzorp.balabit> Content-Type: text/plain On Thu, 2009-01-22 at 15:26 +0000, Pedro Rafael Alves Simoes wrote: > Hello, > > In my syslog-ng configuration I'm writing messages to named pipes > which name is given dynamically by the $PRI macro: > > destination d_test { > pipe("/tmp/$PRI.log"); > }; > > All the possible PRI.log pipes were created previously with mkfifo. > > With this configuration the messages aren't being written to the > pipes. It simply does nothing. Doing a strace on the syslog-ng > process, it shows an error : > > open("/tmp/$PRI.log", O_RDWR|O_NONBLOCK|O_NOCTTY|O_LARGEFILE) = -1 > ENOENT (No such file or directory) > > It seems that the PRI macro isn't being interpolated in the string. well, the pipe() driver does not support macros, thus it uses the string literally. More exactly the pipe driver explicitly disallows that. Since I don't remember exactly why I did this, here's a patch that removes the restriction. Please let me know how it works out for you, if it seems to work, I'm also willing to integrate it. Patch is against OSE 3.0, but is trivial to backport to 2.1 diff --git a/src/cfg-grammar.y b/src/cfg-grammar.y index 761bb56..fdfa18f 100644 --- a/src/cfg-grammar.y +++ b/src/cfg-grammar.y @@ -801,7 +801,7 @@ dest_afpipe dest_afpipe_params : string { - last_driver = affile_dd_new($1, AFFILE_NO_EXPAND | AFFILE_PIPE); + last_driver = affile_dd_new($1, AFFILE_PIPE); free($1); last_writer_options = &((AFFileDestDriver *) last_driver)->writer_options; last_writer_options->flush_lines = 0; -- Bazsi

3 3

Re: [syslog-ng] filter killing logging
by Len Conrad 03 Feb '09

03 Feb '09

>the log statement below works > >the #log statement logs nothing > >source src { unix-dgram("/var/run/log"); > unix-dgram("/var/run/logpriv" perm(0640)); > tcp(); > udp(); > internal(); > file("/dev/klog"); > }; > >### smtp postfix > >filter f_mail { facility(mail); }; > >filter f_postfix {match (" postfix"); }; > >destination d_postfix { file("/var/log/$HOST/maillog"); }; > >log { source (src) ; filter (f_mail); filter(f_m_info); destination (d_postfix); }; > >#log { source (src) ; filter (f_mail); filter(f_m_info); filter (f_postfix); destination (d_postfix); }; > >Thanks >Len Sorry about previous msg's null subject and missing version syslog-ng -V syslog-ng 2.0.9 (from FreeBSD pkg, not ver 3 yet) I enabled the postfix, imap3d, sasl, pop3d logging by trimming the trailing/leading spaces of " string " in the filter definitions. huh? Len

1 0

[Bug 31] New: sources are opened after dropping capabilities which prevents opening some
by bugzilla＠bugzilla.balabit.com 03 Feb '09

03 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=31 Summary: sources are opened after dropping capabilities which prevents opening some Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: regression Estimated Hours: 0.0 mkdir /test/ mkfifo /test/fifo chmod 0 /test and use pipe('/test/fifo') as source. syslog-ng 3.0.1 will fail with permission denied because it can't access /test/fifo due to dropped capabilities. This is real example from Linux Vserver based system where /vservers has always 0 permission. The solution would be probably to not drop some caps until sources are opened. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

(no subject)
by Len Conrad 03 Feb '09

03 Feb '09

the log statement below works the #log statement logs nothing source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0640)); tcp(); udp(); internal(); file("/dev/klog"); }; ### smtp postfix filter f_mail { facility(mail); }; filter f_postfix {match (" postfix"); }; destination d_postfix { file("/var/log/$HOST/maillog"); }; log { source (src) ; filter (f_mail); filter(f_m_info); destination (d_postfix); }; #log { source (src) ; filter (f_mail); filter(f_m_info); filter (f_postfix); destination (d_postfix); }; Thanks Len

1 0

loggen
by nexact 03 Feb '09

03 Feb '09

Hello, I'm looking for 'loggen' utility to benchmark my current infrastructure, I can't find it in the website download section... Anyone could help me ? Thanks.

3 2

Getting warnings while building syslog-ng-2.1.3 on HP-UX ITA64
by Chanchal Verma 03 Feb '09

03 Feb '09

Hi, I am trying to build syslog-ng-2.1.3 on HP-UX Itenium (64-bit) box. I am doing '--enable-dynamic-linking' and it is giving following warning messages while 'make'. ************************Warning messages during 'make' ******************* .. .. gcc -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -lcl -o loggen loggen.o -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap ld: (Warning) Unsatisfied symbol "yyleng" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytext" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylex" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyout" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "deny_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "allow_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "rfc931_timeout" in file /usr/lib/hpux32/libwrap.so 20 warnings. ******************************************************************************* It is giving me similar error message while running syslog-nd daemon and fail. I have installed flex to get rid of libl.so but no success. # swlist |grep -i flex flex 2.5.4a flex # gcc -v Using built-in specs. Target: ia64-hp-hpux11.31 Configured with: ../gcc/configure Thread model: posix gcc version 4.2.3 Here is configure result: ================================ syslog-ng Open Source Edition 2.1.3 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -I/usr/local/include/glib-2.0 -I/usr/local/lib/hpux32/glib-2.0/include -I/opt/soe/local/syslog-ng-2.1.3/eventlog/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap prefix : /opt/soe/local/syslog-ng-2.1.3 Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no ================================ Any help will be highly appreciated. -- Chanchal

1 0